Ethan Rose created HDDS-16356:
---------------------------------
Summary: SCM finalize API should only be reachable by OM
Key: HDDS-16356
URL: https://issues.apache.org/jira/browse/HDDS-16356
Project: Apache Ozone
Issue Type: Improvement
Reporter: Ethan Rose
Assignee: Ethan Rose
With the new ZDU finalization flow, the admin sends the finalize request to OM
and OM forwards it to SCM. The admin is never supposed to finalize SCM
directly. This ensures that components are always finalized in the expected
order.
Currently SCM's finalize command is under the container location protocol with
other admin facing commands guarded by an admin check. This happened to work in
the ZDU acceptance test suite because OM was configured as a cluster admin,
however this is not expected in a real deployments. Additionally, it allows a
custom client created by an admin to invoke this API out of order.
Instead, the new finalize API should be in the block location protocol, which
is completely restricted to OM's kerberos principal. Additionally, the
acceptance tests should not configure OM as an admin since it masks issues like
this.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
